1 writeup tagged privilege-escalation.
A real-world case where UI-level permission controls were not enforced at the API level, allowing message sending and user impersonation.
related tags